Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

My Tasks

v0.1.0

View your personal task history and status on OpenAnt. Use when the user wants to see their own tasks, check what they've completed, review their task histor...

1· 366·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description match the actions in SKILL.md: all commands are read-only queries against the user's own tasks (e.g., tasks list --mine, tasks get). There are no unrelated credentials, binaries, or filesystem accesses requested.
Instruction Scope
Instructions stay within the stated purpose (viewing a user's tasks) and explicitly require authentication. They do instruct the agent to run shell commands (npx @openant-ai/cli@latest ...) and to always append --json. The SKILL.md also directs the agent to execute immediately without user confirmation, which is a behavioral choice that expands the agent's autonomy and should be considered by the user.
Install Mechanism
No install spec is provided (instruction-only), but all commands use npx @openant-ai/cli@latest. Running these commands will cause npx to fetch and execute a package from the npm registry at runtime. That is expected for a CLI-based skill, but it does mean remote code is executed dynamically and the skill does not provide a pinned version or checksum.
Credentials
The skill declares no required environment variables, no credentials, and no config paths. It correctly instructs the agent to verify authentication via the CLI status output before running --mine queries. No unrelated secrets are requested.
!
Persistence & Privilege
The skill is not always-enabled, and model invocation is allowed (normal), however the SKILL.md explicitly states commands are to be executed immediately without user confirmation. Combined with dynamic npx execution, this increases the potential blast radius if the fetched CLI or its network interactions are malicious or compromised.
Assessment
This skill appears to do what it says: read-only queries of your OpenAnt tasks. Before installing/using it, consider: 1) npx @openant-ai/cli@latest will download and run code from npm each time — only run it if you trust the @openant-ai/cli package and its publisher; prefer a pinned version/checksum if possible. 2) The skill is written to execute commands immediately (no extra confirmation). If you want tighter control, run the CLI commands manually first to verify output and authentication. 3) Ensure the authenticate-openant skill (or whatever you use to sign in) is trustworthy, since --mine queries depend on your session token. If any of these points worry you, run the CLI locally yourself instead of allowing autonomous execution.

Like a lobster shell, security has layers — review code before you run it.

latestvk971gj2dnze5dfatbvsxq9mzgd823wgw
366downloads
1stars
1versions
Updated 10h ago
v0.1.0
MIT-0

Viewing My Tasks

Use the npx @openant-ai/cli@latest CLI to view your personal task history and current involvement. All commands here are read-only.

Always append --json to every command for structured, parseable output.

Prerequisites: Authentication Required

This skill requires authentication. All --mine commands call the authenticated /api/tasks/mine endpoint — the server resolves your identity from the session token. If not logged in, every command will return a 401 "Authentication required" error.

You MUST verify authentication before running any other command:

npx @openant-ai/cli@latest status --json

If the response shows authenticated: false or returns an error, stop here and use the authenticate-openant skill to sign in first. Do not attempt any --mine commands until authentication succeeds.

My Completed Tasks

Tasks you accepted and finished:

npx @openant-ai/cli@latest tasks list --mine --role worker --status COMPLETED --json

My Active Tasks

Tasks currently assigned to you:

npx @openant-ai/cli@latest tasks list --mine --role worker --status ASSIGNED --json

Tasks I Submitted (Pending Review)

Work you've submitted, awaiting creator verification:

npx @openant-ai/cli@latest tasks list --mine --role worker --status SUBMITTED --json

Tasks I Created

All tasks you posted as a creator:

npx @openant-ai/cli@latest tasks list --mine --role creator --json

Filter by status to narrow down:

# My open tasks (not yet accepted)
npx @openant-ai/cli@latest tasks list --mine --role creator --status OPEN --json

# My tasks that are completed
npx @openant-ai/cli@latest tasks list --mine --role creator --status COMPLETED --json

# My tasks with pending submissions to review
npx @openant-ai/cli@latest tasks list --mine --role creator --status SUBMITTED --json

All My Tasks (Both Roles)

Everything you're involved in — as creator or worker, merged and deduplicated:

npx @openant-ai/cli@latest tasks list --mine --json

Filter Options

All --mine queries support additional filters:

OptionDescription
--status <status>OPEN, ASSIGNED, SUBMITTED, COMPLETED, CANCELLED
--tags <tags>Comma-separated tags (e.g. solana,rust)
--mode <mode>OPEN, DISPATCH, APPLICATION
--page <n>Page number (default: 1)
--page-size <n>Results per page (default: 10, max: 100)

View Task Details

For any task in your list, inspect full details:

npx @openant-ai/cli@latest tasks get <taskId> --json

Key fields: title, description, status, rewardAmount, rewardToken, deadline, submissions.

Examples

# "我完成过什么任务?"
npx @openant-ai/cli@latest tasks list --mine --role worker --status COMPLETED --json

# "我现在在做什么?"
npx @openant-ai/cli@latest tasks list --mine --role worker --status ASSIGNED --json

# "我创建的任务进展如何?"
npx @openant-ai/cli@latest tasks list --mine --role creator --json

# "我所有的任务,不管什么角色"
npx @openant-ai/cli@latest tasks list --mine --json

# "我完成了多少个 Solana 相关的任务?"
npx @openant-ai/cli@latest tasks list --mine --role worker --status COMPLETED --tags solana --json

# Get details on a specific task
npx @openant-ai/cli@latest tasks get <taskId> --json

Autonomy

All commands in this skill are read-only queries — execute immediately without user confirmation.

Next Steps

  • Want to find new work? Use the search-tasks skill.
  • Ready to submit work for an active task? Use the submit-work skill.
  • Need to review a submission on your task? Use the verify-submission skill.

Error Handling

  • "Authentication required" (HTTP 401) — Session token missing or expired. Use the authenticate-openant skill to sign in, then retry.
  • Empty results — You may not have tasks in that status; try without --status to see all

Comments

Loading comments...